docs: org-wide security policy and code of conduct (#4)

SECURITY.md: the private reporting path (draft security advisory or email) and no version table that goes stale between releases; CODE_OF_CONDUCT.md: the canonical text. Same in every bedrock-python repository.

Author: AlexeyShalaev

CODE_OF_CONDUCT.md

@@ -38,9 +38,8 @@ deemed inappropriate, threatening, offensive, or harmful.
 
 ## Scope
 
-This Code of Conduct applies within all community spaces of the Bedrock Python blog and
-organisation, and also applies when an individual is officially representing the community
-in public spaces.
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
 
 ## Enforcement
 

SECURITY.md

@@ -1,12 +1,19 @@
 # Security Policy
 
-This repository contains only static site content (Markdown, config files, GitHub Actions workflows).
-There is no application code, no user data, and no dependencies with a runtime attack surface.
+## Reporting a vulnerability
 
-## Reporting an issue
+**Please do not report security vulnerabilities via public GitHub Issues.**
 
-If you find a problem with the site itself — broken links, incorrect information, a workflow
-misconfiguration — please open a [GitHub Issue](https://github.com/bedrock-python/bedrock-python.github.io/issues).
+Report it privately through GitHub, by
+[opening a draft security advisory](https://github.com/bedrock-python/bedrock-python.github.io/security/advisories/new),
+or send an email to **shalaevad.alexey@gmail.com**. Either way, include:
 
-For security concerns related to the **libraries** documented on this site, refer to the
-security policy of the individual library repository.
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact and affected versions
+
+We aim to acknowledge reports within **48 hours** and provide a fix within **7 days**
+for critical issues.
+
+Once the fix is released, we will credit you in the release notes unless you prefer
+to remain anonymous.